Accidental Partition Table Change-- How to recover data?

basically, i ruined my partition table ( i think ) and now i must find software to help me un-do what bootMagic did to it.

please see PartitionMagic screen shot here. http://www.e-nationmusic.com/pics/PM8_screen.jpg
the NTFS drive (drive E in the pic) should only be one partition. there is 87.xx gigs of data that. it is crucial that i recover this data.
A nice program called Virtual Lab is able to see all of my directories and files, just the way i left them, but i do not have the $535 that it will cost to proceed w/ their recovery process.

does anyone have advice on how i might manually recover my partition table?

i have several data recovery/ system utilities. any suggestion is appreciated.
thanks!

It's easy to reconstruct a new partition table without damaging your data. In fact, I do this all the time in my computer shop when a customer screws up their computer or a virus attacks the partition tables or something.

I don't want to make this sound scary or anything, but it's easiest to use Linux's fdisk to fix your problem. For example, a bootable knoppix (www.knoppix.org) CD does the trick for me. It's worth the download for you if you want to follow my instructions.

There is one catch, you need to know exactly how your partition was set up beforehand!

You'd better try this, 'cuz I'm writing it out step by step.

Okay, we boot with the knoppix CD. At the first prompt, type "knoppix 2" (enter) -- this will give us a plain root command prompt, with full access to the whole machine.

You want to load up fdisk for your hard drive. The command to run depends on where you have your hard drive plugged in on the IDE chain. Primary Master is "hda", primary slave is "hdb", secondary master is "hdc" and secondary slave is "hdd"

At the prompt, I type "fdisk /dev/hdc" (enter) This loads fdisk, and gives us the initial warnings and stuff, and possibly a message about how messed up your partition table is. you can type the letter "m" for help, but I'm going to give you all the commands to type, so don't worry so much about everything else unless you feel like exploring.

First, type "p" (enter) to print your current partition table. You might have anywhere between 1 and 6 partitions (your screenshot indicates 4). You need to "d" delete these all by number, there might be partition 1, 2, 5, or any combination of any number. Typically 1-4 are primary partitions and 5-whatever are extended with logical drives. Okay, so you've just deleted every partition on the drive, so if you type "p" again and it doesn't list any partitions, good.

Now we need to re-create our one partition. Type "n" for new, it will ask us what partition number do we want to use? Here we select "1" because it is the first and only partition that we are putting back on the drive. Next it asks us what physical cylinder on the drive do we want to begin the partition on. Since you only had one, we will start at the default "1" (just hit enter for the default). Following that it will ask how big you want the partition to be. Again, we just want to hit enter for the default, which is the maximum size.

We now need to change the partition type to NTFS. Issue the "t" command, which will allow us to change the partition's ID bit, which is set at Linux by default. Now, if you had a basic disk before (which you most likely did) type the number 7, which is HPFS/NTFS. If you had a dynamic disk before (which you most likely did not) type the number 42, which is SFS, which means absolutely nothing.

After you've done that, print "p" the partition table again to make sure it looks good. Hell, type "a" just for fun to set it active and give it the bootable flag (if it doesn't have it already).

When that all looks good, type "w" to write all your changes to disk (if you dare!!). It will exit back to the command prompt. If you're unix/linux savvy, you can now mount your drive to a directory to see if your data is there, but it's probably easier to type "reboot" and see if you can see it in windows now.

Assuming your data is not corrupted and you were able to rewrite your partition table exactly how it was before, you should see everything just fine on the drive. If not, you're no worse off than you were before. You can always boot back up in Knoppix and modify numbers around if you don't think you did it right the first time.

Out of that CrazyOne recovery tools list I recommend R-STUDIO from www.r-tt.com. The demo is a free download where you can scan the hard drive and see if your files are there, and it will even let you recover files up to 64K for free. Above that, the program is only $90 for a version that supports NTFS, if I remember correctly.

Good luck, and be sure to post here with what you've tried.

p.s. if you don't have the bandwidth or the patience to download knoppix, there are several single-floppy distributions that should give you the same fdisk and the same functionality, but I don't have links to any of them. Google is your friend. LRP might work, but they killed support over a year ago, so it might be a lost cause.

i don't have on any of my drives, nor do i know how to use Linux... i'm assuming that this renders your extremly thoughtful tips (thank you!) useless for me? or can i do this through DOS on my XP Pro SP1 system?

Raymond ... I see you're new around here and from your posts till now you seem skilled.
I personally see no way that your solution will work, since recreating the partition will not recreate the filesystem. Indeed, the data will still be phisically there, but no file entry to point to the bits written on the data zone. I'm dead curious if this will work though, I recommend jsabarese to try it, especially that you gave him very detailed directions on how to use fdisk. Indeed, it can't harm.

The reason I think this would work is because his filesystem shouldn't have been damaged by that boot manager software. I believe the NTFS superblock resides somewhere closer to the middle of the partition, and it wouldn't be erased unless he "formatted". The partition lies in the first 512 bytes of the hard disk, and if he is able to reconstruct that to how it was before identically, windows shouldn't notice. I know for a fact this works with fat32, and I have seen it work with ntfs, but I haven't done it enough with XP hard drives to guarantee the method.

If the drive was to boot again, he might need to clear the MBR along with the partition table first, which could be done with this command, though he would have to still recreate his partition table somehow after he did this:

dd if=/dev/zero of=/dev/hda bs=512 count=1

That linux command is very dangerous, because you get into writing zeros to the hard drive. If you mess up and accidently hit enter before you type the bs or count parts, bye bye data.

DiskProbe is a sector editor tool for Windows XP Professional that allows users who are members of the Administrators group to directly edit, save, and copy data on a physical hard disk. With careful use of DiskProbe, you can replace the master boot record (MBR), repair damaged partition table information, and repair or replace damaged boot sectors or other file system data. You can also use DiskProbe to save MBRs and boot sectors as backup binary files in case the original sectors become damaged by viruses, human error, hardware problems, power outages, or similar events. Unless you are familiar with using DiskProbe, try other troubleshooting tools, such as Recovery Console, before using DiskProbe.

Caution
* Be cautious when making any changes to the structures of your hard disk. Because DiskProbe does not validate the proposed changes to records, incorrect values in key data structures can render the hard disk inaccessible or prevent the operating system from starting. If you cannot correct the changes you entered, you must re-create and reformat all volumes on the disk.

DiskProbe can change the values of individual bytes in any sector on a dynamic disk, but it cannot navigate the structure of a dynamic disk. Therefore, it is recommended that you use DiskProbe only on basic disks. You can, however, use DiskProbe to back up and restore the boot sector and MBR of dynamic disks.

DiskProbe is part of Windows Support Tools. For more information about DiskProbe, click Tools in Help and Support Center, and then click Windows Support Tools.
more info:

Google Cloud Storage has a number of classes to choose from. Although there are a lot in common, they vary in price and usage terms. This post explains Google Cloud Storage classes and helps to understand which one to choose.

Line 0 through line 1bd (the 14th character on the line 1b0) is all the master boot record. It's the actual boot code windows wrote, it displays the error messages like "missing operating system" during boot. After that is the partition table. Each partition (there can be four) takes up 16 byes. The last two bytes of the sector (55 AA) identify that sector as a partition block.

In the above example, the first partition is identified by the following 16 bytes:

80 01 01 00 07 FE FF FF 3F 00 00 00 41 7C FC 06

Taken byte by byte, this is what it means:

byte 1, "80" means it's bootable (00 would mean not-bootable (active))
byte 2, is the starting head
byte 3 and 4 are the sector/cylinder starting markers
byte 5, "07" is the type, NTFS (there are tables for what is what)
byte 6 is the ending head
byte 7 and 8 are the sector/cylinder ending markers
byte 9-12 tell where the boot sector for this partition is stores
byte 13-16 tell how many sectors large the partition is

I learned all the above from experimentation and the following web pages:

What's wrong with your drive is that those partition bytes are screwed up. FIXMBR won't fix it, FIXBOOT won't fix it. You can use DiskProbe to fix it, if you know exactly what data to enter in. I recommend using linux fdisk still, though, because it will create it how it's supposed to be, per my above instructions. It doesn't matter if the MBR is screwed up, because that's for booting only. You only care about the 64 bytes that contain the partition table, specifically the first 16 of those.

i installed the windows support tools, (no prompt about diskprobe though... ?) and upon prompted reboot, XP (before the black, splash screen) "corrected" broken links on the drive (e: apparently) and now the drive is readable from the 10 gig, but it's showing a list of files (no extensions) 4kb each, showing some of the directories from the C: drive. what happened there?

and a quick question about what norton system works will do to the drive E...

when i ran Norton System Works. it of course has found an error on the disk. the exact text from Norton is as follows:
error on hard disk = an extended partition is invalid. An extended partition has invalid parameters and is probably inaccessible. correct this situation if you are unable to access partitions on hard disk. do you wish to correct this problem? (end of text)
i've used a utility, FinalData, to scan the disk and it is able to see the files and directories as i left them before i mucked it up w/ BootMagic. my question is-- if i proceed w/ the Norton fix, might it further jeopardize my data, or will it leave it intact?
i appreciate any advice on disk Dr. thanks.

I recommend using Symantec's software to correct the error. However, if you say that "FinalData" found your files, why don't you do a backup of what you need and only after that let NU repair the error.
I won't be back till next year, so Good Luck and a Happy new year to all of you

Featured Post

With up to 8TB of storage, give your favorite graduate their own personal cloud to centralize all their photos, videos and music in one safe place. They can save, sync and share all their stuff, and automatic photo backup helps free up space on their smartphone and tablet.

Sometimes the best way to deal with an infected computer is to boot from external media and run your tools from there. The reason you may wish to do this really depends on the infection. Some malware is so recalcitrant that no matter what you do i…

Ever notice how you can't use a new drive in Windows without having Windows assigning a Disk Signature? Ever have a signature collision problem (especially with Virtual Machines?) This article is intended to help you understand what's going on and…

This video teaches viewers how to encrypt an external drive that requires a password to read and edit the drive. All tasks are done in Disk Utility.
Plug in the external drive you wish to encrypt:
Make sure all previous data on the drive has been …

This Micro Tutorial will teach you how to reformat your flash drive. Sometimes your flash drive may have issues carrying files so this will completely restore it to manufacturing settings. Make sure to backup all files before reformatting.
This w…